Facebook’s Onavo Acquisition: A VPN-Turned-Surveillance Tool and Its Role in Market Dominance

In October 2013, Facebook acquired Onavo, an Israeli mobile analytics and VPN company, for an estimated $120 million. Onavo’s flagship product, a virtual private network (VPN) app, was marketed as a tool to protect user privacy, compress data, and reduce mobile bandwidth costs. However, behind the scenes, it became a powerful surveillance mechanism, granting Facebook unprecedented access to user behavior across their entire phones. By routing all device traffic through its servers, Onavo allowed Facebook to collect granular data on which apps users opened, how long they used them, and even specific in-app actions. Estimates suggest the app reached over 33 million users globally, though exact figures remain unverified due to limited public data.

Strategic Use of Onavo’s Data.

The intelligence gathered through Onavo gave Facebook a competitive edge in the tech landscape. One of its most significant impacts was informing the $19 billion acquisition of WhatsApp in February 2014. Onavo’s analytics revealed WhatsApp’s meteoric rise, showing it handled over twice the daily message volume of Facebook Messenger. This data underscored WhatsApp’s threat to Facebook’s messaging dominance and justified the hefty price tag, which was among the largest tech acquisitions at the time.

Onavo’s insights didn’t stop at WhatsApp; they provided a broad view of the mobile ecosystem, helping Facebook identify emerging competitors and trends.

Project Ghostbusters: Decrypting Snapchat
In 2016, Facebook leveraged Onavo’s technology for a controversial initiative dubbed “Project Ghostbusters,” aimed at cracking Snapchat’s encrypted traffic. Snapchat’s end-to-end encryption made it difficult for competitors to analyze user behavior, but Facebook found a workaround. Using Onavo’s VPN infrastructure, they developed “kits” for iOS and Android devices that performed man-in-the-middle (MITM) attacks. These kits, installed with user consent (often obtained through incentives like gift cards), intercepted Snapchat’s network traffic before it was encrypted or after decryption, allowing Facebook to access detailed analytics on user interactions.

This wasn’t a cryptographic breakthrough but a strategic exploitation of Onavo’s position as a trusted VPN. The program, part of Facebook’s In-App Action Panel (IAPP), later expanded to monitor YouTube and Amazon traffic, running until 2019. Court documents unsealed in a 2024 antitrust lawsuit against Meta detailed these efforts, with internal emails revealing executives’ awareness of the ethical and legal risks. Some legal experts argue this violated wiretapping laws, though Meta has dismissed the allegations as “baseless” and emphasized that users consented to data collection.

Onavo’s Operations and Ethical Concerns.

Onavo’s data collection wasn’t limited to organic app downloads. Facebook actively promoted the app through a “research” program, paying users aged 13–35 up to $20 monthly to install it, including a companion app called Facebook Research. This raised red flags, particularly for targeting teens. Participants, often unaware of the extent of monitoring, granted Facebook access to nearly all phone activity, including private messages, browsing history, and app usage. Reports estimate tens of thousands joined the program, amplifying Onavo’s reach.

The app’s dual role as a consumer VPN and a data-collection tool sparked privacy concerns. In August 2018, Apple removed Onavo from its App Store, citing violations of its guidelines on data collection. Facebook continued offering the app through alternative channels, like direct APK downloads for Android, until February 2019, when it shut down Onavo entirely amid mounting scrutiny. The backlash highlighted tensions between user privacy and tech giants’ data-driven strategies.

Legal and Market Implications.

The 2024 antitrust lawsuit, filed by Snapchat and other plaintiffs, brought Onavo’s practices into sharp focus. Court filings allege Facebook used Onavo to stifle competition, giving it an unfair advantage in the social media market. While Onavo’s data didn’t directly “break” Snapchat’s encryption (a misnomer in the original thread), it enabled Facebook to replicate Snapchat’s features, like Stories, which Instagram introduced in 2016. This contributed to Snapchat’s slowed growth, a key point in the lawsuit.

The claim of “33M+ users’ entire phones” spied on likely draws from Onavo’s peak popularity, with 24 million downloads reported by 2018 and additional users from the research program. However, no definitive source confirms the exact scale. Meta maintains that Onavo’s data collection was transparent and consensual, but critics argue the fine print buried the app’s true purpose.

Broader Context and Legacy.
Onavo’s story underscores how tech companies weaponize user data for competitive advantage. The acquisition, initially seen as a minor deal, became a cornerstone of Facebook’s strategy to dominate mobile messaging and social media.

It also fueled regulatory scrutiny, with Onavo cited in investigations by the U.S. Federal Trade Commission (FTC) and European regulators over Meta’s data practices.

Key sources include TechCrunch (2018), The Wall Street Journal (2019), and court filings from the 2024 lawsuit.